insert-image-changing-visibility-crash-iframe.html

<!DOCTYPE html>
<html>
<head>
<title>Issue 348283 crash test case</title>
<style>
table {
    visibility: collapse;
}

*:only-child {
    visibility: visible;
}
</style>
</head>
<!-- This is a minified version of the clusterfuzz test case at https://code.google.com/p/chromium/issues/detail?id=348283 -->
<body contenteditable="true">
<script>
window.onload = function () {
    var table = document.getElementById('table');
    table.insertAdjacentHTML('afterbegin', '<svg></svg><div><div id=\'div\'>text</div>');

    var div = document.getElementById('div');
    var selection = window.getSelection();
    selection.collapse(div.firstChild, 0);
    document.execCommand('InsertImage', false, 'about:blank');
    window.parent.postMessage('FINISH', '*');
};
</script>

<table id="table" ></table>
<div></div>
</body>
</html>

chromium/third_party/blink/web_tests/editing/execCommand/resources/insert-image-changing-visibility-crash-iframe.html